While most compliance professionals know “UDAAP” stands for Unfair, Deceptive, or Abusive Acts or Practices, few truly understand this standard due to the lack of statutory language and regulatory guidance on the subject.

UDAAP became a familiar acronym for the credit union industry after passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, but its origins long predate Dodd-Frank. The first version, originally referred to as Section 5 of the FTC Act, was introduced in 1938.

In 2004, the Federal Trade Commission (FTC) expanded the section to include Unfair and Deceptive Acts and Practices, and “UDAP” was born.

Under the FTC Policy Statement on Unfairness, an act or practice is unfair when it causes or is likely to cause substantial injury (usually monetary) to consumers, can’t be reasonably avoided by consumers, and isn’t outweighed by countervailing benefits to consumers or to competition.

An act or practice is deceptive when it involves a material representation, omission, or practice that is likely to mislead a consumer acting reasonably in the circumstances. We use the same language today to define unfair and deceptive practices.

Adding a second ‘A’

In 2010, the FTC’s UDAP underwent a drastic transformation when the Dodd-Frank Act added the second “A” for “abusive,” transforming UDAP into UDAAP. This change led to a huge wave of UDAAP enforcement actions without a clear standard to determine what, exactly, constitutes a UDAAP violation. All we had to go on was the definition of “abusive acts or practices” that Congress defined in section 1031(d) of the Dodd-Frank Act. This section prohibits companies from:

• Materially interfering with someone’s ability to understand a product or service.
• Taking unreasonable advantage of someone’s lack of understanding. 
• Taking unreasonable advantage of those who can’t protect themselves.
• Taking unreasonable advantage of someone who reasonably relies on a company to act in their interests.

The limited definitions and lack of clearly defined products and services that are at-risk for UDAAP violations created a scary environment for covered institutions as the regulators applied a “know it when you see it” standard of enforcement in the years following Dodd-Frank.

Credit unions were expected to stay on top of all new enforcement actions the Consumer Financial Protection Bureau (CFPB) issued to try to determine what constituted an abusive practice and, more important, how to avoid a similar fate at their own institutions.

NEXT: Enforcement slows